How Hackers Are Exploiting PTC Windchill and FlexPLM Without a Password

Robert Moore · 2026-07-25

### The Latest Data Extortion Campaign Threat actors linked to the Cl0p ransomware group—also known as Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest—are actively exploiting vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems. This isn't just another cyberattack. It's a data extortion campaign that relies on chaining two specific flaws to gain access without needing any authentication. If you're using these platforms, you need to pay attention. The attackers are targeting companies that have left these systems exposed to the internet, and the consequences can be devastating. ### How the Attack Works The attack chain is clever and dangerous. First, the bad guys exploit a pre-authentication information disclosure vulnerability in the FlexPLM WSDL endpoint. This lets them gather sensitive details about the system without logging in. Then, they chain that with a server-side flaw in the Windchill login servlet. The result? Unauthenticated remote code execution (RCE). In plain English, they can run malicious code on your server without ever needing a username or password. This isn't theoretical. We're seeing active exploitation right now. The Cl0p group has a long history of pulling off massive ransomware and extortion schemes, and this campaign is their latest play. ### Why This Matters for Your Business If your company uses PTC Windchill or FlexPLM, and those systems are accessible from the internet, you're in the crosshairs. Here's what's at stake: - **Data theft**: Attackers can steal intellectual property, customer data, and trade secrets. - **Ransom demands**: Once they have your data, they'll demand payment—often in Bitcoin or other cryptocurrencies—to keep it private. - **Operational disruption**: Even if you pay, recovery takes time and money. The average downtime from a ransomware attack can stretch into weeks. And here's the kicker: Cl0p isn't just encrypting files anymore. They're focusing on extortion. They steal your data and threaten to leak it publicly if you don't pay up. That means even if you have backups, you're still vulnerable. ### Steps to Protect Your Systems So, what can you do right now? Here's a practical checklist: - **Patch immediately**: PTC has released security updates for these vulnerabilities. Apply them as soon as possible. - **Limit internet exposure**: If your Windchill or FlexPLM servers don't need to be public, take them offline. Use VPNs or other secure access methods instead. - **Monitor for suspicious activity**: Look for unusual login attempts, unexpected data transfers, or strange traffic to and from these systems. - **Implement network segmentation**: Keep critical systems isolated from the rest of your network. That way, even if one server is compromised, the damage is contained. - **Train your team**: Make sure your IT staff knows what to look for. Awareness is your first line of defense. ### The Bigger Picture This campaign is a reminder that no system is safe if it's exposed to the internet without proper protection. The Cl0p group has been active for years, and they're constantly refining their tactics. They target high-value industries like manufacturing, engineering, and supply chain management—exactly where PTC's tools are most common. Think of it like leaving your front door unlocked in a busy city. Sure, most people will walk past. But eventually, someone will try the handle. And if they get in, they'll take everything they can carry. ### What's Next? We'll likely see more attacks like this as threat actors continue to exploit known vulnerabilities. The key is to stay ahead of them. Keep your software updated, reduce your attack surface, and always assume someone is trying to break in. If you need help assessing your risk or securing your systems, don't wait. Reach out to a cybersecurity professional who understands these threats. The cost of prevention is always lower than the cost of recovery. Stay safe out there.